1

I need to download some files which are distributed as a torrent. The files aren't pirated / restricted so i dont need to worry about a VPN.

My main concern is securing my computer when downloading the files. Im using a macbook pro running 10.10.5 (all latest patches). Ive also got Avast mac anti virus (free) installed.

My current workflow is : add torrent to transmit (torrent client), set download location to a custom folder, once download is complete run an Avast custom scan on the download location folder. If scan comes back with no results i open the file as normal.

Is there anything else i can do to increase the security of my computer from Viruses, malware and other unwanted issues when downloading torrents ?

Improve this question
6
  • @danielAzuelos do you mean like a checksum ? If so no. Could you clarify what your referring to by "these"
    – sam
    Jun 25, 2017 at 19:07
  • Does the source of the files provide a signature (MD5, sha2, gpg...) of these (files)?
    – dan
    Jun 25, 2017 at 21:15
  • How does a person "open the file as normal"?
    – techraf
    Jun 26, 2017 at 7:04
  • Even if a checksum was provided there is no guarantee that the original file is not malware. How can you trust the checksum? If it is from a random torrent site you can’t. If it is from a vendor and a bit torrent mirror just happens to be the download method then you can more faith. Even then it isn’t always a sure thing: theregister.co.uk/2016/02/21/…
    – TheJulyPlot
    Jun 26, 2017 at 7:25
  • @techraf by double clicking the file and having it open in its default programme
    – sam
    Jun 26, 2017 at 10:39

1 Answer 1

Reset to default
3

This assumes you are interested in ensuring the file maintains integrity in transit.

If you have access to the source files before transmit you should run a hash on the files such as sha256 or if they are large then save a litttle time using the older sha1 (depends how much you want to trust the source, md5 might be acceptable for you even)

Keep the hashes safe, when the files are received at the other end recheck the hashes.

Make sure you check at the destination before executing them though!

If you are wanting general security advice then the same rules of downloading any file apply. Such as:

  • Keep up to date AV
  • Execute with minimum privileges needed
  • Keep OS patched

You could also (If you think it's worth the effort) sandbox the downloads (even in its own VM) if you wanted. But I don't know what the files are for so only you will know if this level is needed.

Improve this answer
5
  • how do you execute a file with minimum privileges - if its a pdf or video file (various formats)
    – sam
    Jun 26, 2017 at 10:43
  • I'm saying make sure you are not logged in with administrative/system level privileges. Just the level you need to get the file/application to do what you need.
    – ISMSDEV
    Jun 26, 2017 at 11:42
  • ah ok, so create another user account with standard privileges and use the file from there. If i did that would i be able to test if file was malicious and then transfer to admin account (the account i use everyday). How would i be able to tell if the file was malicious, as i guess it could start by running some background tasks or lay dormant for a while ?
    – sam
    Jun 26, 2017 at 15:21
  • it will not detect if malicious. Depending on you ACL will govern which accounts can do what with the file. It's more of a best practice to run with the min privileges you need. You shouldn't be using an admin account for normal everyday working.
    – ISMSDEV
    Jun 26, 2017 at 17:00
  • Correct me if I am wrong, but I believe malware exists that can detect if it's running in a VM and try to escape. Also, if the VM is connected to the network, it isn't truly sandboxed, right?
    – Kellen Stuart
    Sep 11, 2018 at 5:44

Not the answer you're looking for? Browse other questions tagged .